feat: execute_rest_read / execute_rest_write tools (1.19.0)#40
Merged
Conversation
Adds open-ended REST escape hatches matching the existing
execute_custom_query for GraphQL. Lets agents reach any /api/v4
endpoint not covered by a dedicated tool instead of waiting for a
curated tool PR.
Split into two tools so the read variant is readOnlyHint: true /
requiresWrite: false and the write variant is requiresWrite: true /
destructiveHint: true. Same shape as the GITLAB_TOKEN /
GITLAB_READ_TOKEN separation — the read tool works with a read-only
token, the write tool is rejected by getClient when only a read token
is configured. Lets the MCP harness gate destructive calls without
asking the model to self-declare intent.
Path is validated to be /api/v4-relative before the request runs:
must start with '/', no host, no '?' query string (use the query
arg), no '..' segments. Prevents the caller from escaping the
configured GitLab base URL.
Also:
- restRequest now accepts PATCH (some endpoints use it, e.g. some MR
approval-rule routes)
- Cleaned up a no-op startsWith('gid://') ternary in markAllTodosDone
whose two branches resolved to the same value
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Opens up the full GitLab REST API to the model without waiting for curated tool PRs — same shape as the existing `execute_custom_query` does for GraphQL.
Split into two tools as discussed:
This mirrors the GITLAB_TOKEN / GITLAB_READ_TOKEN separation — read-only deployments physically cannot execute the write tool because `getClient()` rejects it. Destructive intent gating happens at the harness layer (the write tool's `destructiveHint` lets the MCP permission UI flag DELETEs) rather than asking the model to self-declare.
Path validation
Before any request, the path is checked:
Prevents the caller from escaping the configured GitLab base URL.
Cleanups along the way
Test plan